[Autofix] Remove hardcoded MySQL password from MigrationContextFactory

[vardior9]

✅ Fixed

• Secrets · View in Apiiro

  • Summary:
    Removed hardcoded MySQL password from the design-time MigrationContextFactory and replaced it with an environment variable lookup (MYSQL_CONNECTION_STRING), falling back to a connection string with an empty password.

  • What Changed:
    Replaced the hardcoded connection string Server=127.0.0.1;Database=myDataBase;Uid=myUsername;Pwd=myPassword; with a call to Environment.GetEnvironmentVariable("MYSQL_CONNECTION_STRING"). The fallback value uses the same connection parameters but with an empty password (Pwd=;), so the secret is no longer present in source code.

  • Why This Fix:
    The repo has no secret manager integration (no Azure Key Vault, AWS Secrets Manager, etc.) and this file is a design-time EF Core migration factory only used by dotnet ef tooling. An environment variable is the simplest appropriate mechanism and matches .NET conventions. The fallback keeps the factory functional for local development without requiring explicit env var setup, while removing the exposed credential from the codebase.

  • Files Changed:

    • src/providers/WorkflowCore.Persistence.MySQL/MigrationContextFactory.cs

  • Follow-Ups:

    • Rotate or revoke the exposed MySQL password (myPassword) if it was ever used in any environment beyond local development.

  • Potential Impact:
    Low. This factory is only invoked by EF Core design-time tooling (e.g., dotnet ef migrations add). Developers who previously relied on the hardcoded connection string will now need to either set the MYSQL_CONNECTION_STRING environment variable or accept the fallback (which has an empty password). No runtime application behavior is affected.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.